What’s Vulnerable › Vulnerabilities

CVE-2026-59112: Signature validation vulnerability affecting DigiDoc applications

• Severity: medium (CVSS 4.4 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-10 · updated 2026-09-01
• Weakness: CWE-347

Description

Improper verification of cryptographic signature and Improper Check for Unusual or Exceptional Conditions vulnerability in Estonian Information System Authority (RIA) libdigidocpp, DigiDoc4, DigiDoc on Android, and DigiDoc on iOS. This issue affects libdigidocpp: from 4.1.0 before 4.2.1; DigiDoc4: from 4.7.0 before 4.8.2; DigiDoc on Android: from 2.7.0 before 2.7.2; DigiDoc on iOS: from 2.8.0 before 2.8.1.

Affected products

• Estonian Information System Authority (RIA) DigiDoc: from 2.7.0 before 2.7.2; from 2.8.0 before 2.8.1 — fixed in 2.7.2, 2.8.1
• Estonian Information System Authority (RIA) DigiDoc4: from 4.7.0 before 4.8.2 — fixed in 4.8.2
• Estonian Information System Authority (RIA) libdigidocpp: from 4.1.0 before 4.2.1 — fixed in 4.2.1

How to fix

Upgrade to a fixed version: Estonian Information System Authority (RIA) DigiDoc 2.7.2, 2.8.1; Estonian Information System Authority (RIA) DigiDoc4 4.8.2; Estonian Information System Authority (RIA) libdigidocpp 4.2.1. Check the vendor advisory for mitigations.

References

• https://github.com/open-eid/libdigidocpp/pull/690
• https://www.id.ee/en/article/ria-soovitab-kasutajatel-uuendada-id-tarkvara-eng/
• https://www.ria.ee/blogi/digidoc-rakendustes-esinenud-turvanorkus-mis-juhtus-ja-kuidas-see-parandati
• https://github.com/open-eid/libdigidocpp/pull/690

Get alerted when CVE-2026-59112 or the next vulnerability affects your stack